Hot answers tagged

9

Passive FTP requires that the FTP server have ports opened to it from the external network. Azure VM's use NAT, and thus needs extra configuration in order to support passive FTP. The (rough) checklist: Set the external VIP in the IIS FTP manager Set the port range to use (you might wanna show some moderation here - configuring thousands of ports are not ...


8

It's not SHA causing the problem, it's TLS 1.0. The SSL Labs report for your domain gives the full story. Your server only supports TLS 1.0, not 1.1 or 1.2. In addition, it still supports obsolete ciphers like RC4, and doesnt support perfect forward secrecy. Tuning IIS to get better security is quite possible, but a pain to do by hand. This wonderful ...


8

Http/2 requirements as per https://http2.github.io/http2-spec/#rfc.section.9.2.2 : 9.2.2 TLS 1.2 Cipher Suites A deployment of HTTP/2 over TLS 1.2 SHOULD NOT use any of the cipher suites that are listed in the cipher suite black list (Appendix A). Endpoints MAY choose to generate a connection error (Section 5.4.1) of type INADEQUATE_SECURITY if ...


5

Joseph's answer makes perfect sense, but it doesn't seem to work. The attribute 'serverAutoStart' on the site node in applicationHost.config is not changed. One way to change is: Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.applicationHost/sites/site[@name='Default Web Site']" -name "serverAutoStart" -value "False" but ...


5

In this example, StartSSL is your certificate provider. While logged into StartSSL, use the "Certificate Wizard" to submit your certificate signing request (CSR). You must have already validated your domain with them, which is to say, you went through the Validations Wizard and they've established that you have sufficient ownership of a domain to be ...


5

Set up a 2nd server (such as a virtual machine, or a 2nd daemon on the same host). Use a rewrite rule to reverse proxy requests for something optional to the 2nd server, like an invisible image hidden on the page. Configure the 2nd server to only allow TLS 1.2; don't hotlink to another hostname... make sure to proxy, or it won't be secure so maybe the ...


4

You can use Microsoft's log parser utility. It has the capability of dumping into a SQL database as well as having the ability to create a checkpoint file so that it only imports records it hasn't processed. It can be used either as a stand alone executable or programmatically invoked via an ActiveX control


4

There being a CNAME record rather than a direct address record (A/AAAA) is not a factor. The certificate verification is based on the hostname in the location URL. For navigating to https://example.com/ to work, you would need a certificate that is valid for example.com. Ie, a certificate that either has example.com as the Subject CN (Common Name) or that ...


3

You can download PSEXEC and run the following command: psexec \\servername c:\windows\system32\inetsrv\appcmd For example psexec \\servername c:\windows\system32\inetsrv\appcmd list wp


3

I'm testing this on a fresh 2012 R2 server, when applying the Alexander Hass script (AH-Script), I still get the obsolete cryptography: My Chrome 43 supports the following Cipher suites: [C02B] TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 [C02F] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [009E] TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 [CC14] ...


3

The value of a second CPU depends entirely on your load. In the case of a typical small business web server, a dual CPU system will likely not give you any performance increase. For a database - well, it really depends on the database and your query types and load. A typical website won't make much use of the CPU. Think of a DUAL CPU server as a server ...


3

First, MX records are not SRV records. Second, he's absolutely right. I deal with this issue quite often with one of my clients that also hosts Exchange for their clients. Outlook needs to find autodiscover information that points to the Exchange server. The problem with having a wildcard record is that it causes autodiscover.domain.com to resolve to your ...


3

Two-parter: Yes. First step is identity of the receiving process, so you'll need to use a common identity for the service on both (which functionally means a domain user account, or better, a GMSA.) That'll let you interchangeably connect to either server by name (assuming an SPN is registered for each) but you did mention agnosticism towards which server ...


3

Since you don't intend to use this website externally, and you have a domain, you therefore have an internal certificate authority (CA). You should be able to create a signing request to send to your internal CA that will give you what you need for SSL.


3

I'm extremely skeptical about these results. While IIS may be faster, both posts do not mention anything specific about the hardware, OS settings(filesystem mount options, io schedulers, network buffers, tcp stakck setting and so on), web server config. Modern http servers are extremely complex animals, you can turn on and off huge amount of options, ...


3

Yes it's possible to do this. The technology you are looking for is called Name Based Virtual Hosting.


3

SSL certificates from Amazon Certificate Manager can only be used with CloudFront and Elastic Load Balancers. It cannot be installed directly on an EC2 instance. If your app needs an SSL certificate installed, you will need to get it from another service.


3

Orignally, only one SSL certificate can be assigned to the same IP/Port combination. This is because host header is encrypted and HTTP layer cannot guess which host is requested and which certificate should be presented to client. If so, is there a workaround to make IIS think he can carry two SSL certificates? No, there are no workarounds in Windows ...


3

It's not a role service. It's a role. You will find it by going to Manage > Add Roles and Features:


3

One disadvantage is that your private key may now be on two machines. A client key should be private, by definition. If it's shared, then it's not private. That instantly reduces the trust anyone can have in your certificate. All other users of that server (if there are any) cannot now trust it, as its private key is known to be shared. Your question ...


3

About the only thing I can think of is having a proxy in front of the site that still supports the old standards, and have that redirect the user to a different site if it detects SSL2 or 3 connections (or an unsupported browser string?) Of course, to do this, you'll need a proxy that can talk the old protocols to older browsers securely without potentially ...


3

SSL handshaking occurs before any application-level communication, so if you want to prohibit 2/3 then browsers are going to get a very ugly message. On the other hand, you can enable 2/3 and have your application detect the low version and return the user a specific error message. Unfortunately at this point they've already sent you whatever session ...


3

You either: Connect to the the fully qualified hostname used in the certificate Don't use HTTPS for connections to localhost Generate a self-signed certificate that is valid for localhost


3

If I understand your question correctly, you want to do the following: application-1.my-server.company.com point to my-server.cloudapp.azure.com:8080 application-2.my-server.company.com point to my-server.cloudapp.azure.com:8081 application-3.my-server.company.com point to my-server.cloudapp.azure.com:8082 One solution is the use a reverse proxy. See ...


3

Yes, you can do. You can run any child domain (sub-domain ) on a different server using different web server application (Apache,IIS etc). All you can do is create a sub-domain (A record) in your registrar provided control panel for your main domain and point to the IP where your sub-domain web-server is running. Also make sure that your ServerAlias (in ...


3

Please check if you added the application "wscriativo" (the name you provided in the URL) to some application pool. I had the same problem and this was my problem. Probably you just created the wwwroot and this folder has other broken applications inside it. Add one application for each subfolder you want to run. This way you avoid using the broken ...


2

You can use the Url Rewrite feature of IIS to do that : Open the URL Rewrite feature : Add a rule of type "Request blocking" : Block the requests based on host name : If you know your IP address, you can use it to block requests which use it : Or you can block all requests which are not using the domain name : Hope this helps (It took me ...


2

The IIS failed request trace logs showed that there was an error with impersonation when reading the static files. The group IIS_IUSRS did not have the Impersonate a client after authentication user right in the computer's Local Security Policy. After adding this, the files now load as expected. Can anyone explain why, though? Why would this user right be ...


2

I've managed to confirm your observations (and mine) by looking into the code of ModSecurity IIS module, on GitHub. I found that the code inside CMyHttpModule::OnSendResponse, CMyHttpModule::OnPostEndRequest and CMyHttpModule::OnBeginRequest is wrapped inside EnterCriticalSection(&m_csLock); ... LeaveCriticalSection(&m_csLock); That, coupled ...


2

This solution was covered by Scott Hanselman in his blog (source at the bottom of the answer). Basically, HSTS is just an HTTP header. But you only want to send it when you are not in HTTPS. This will then lock your site in HTTPS for the max-age specified. Here's what should be in the web.config of your application: <?xml version="1.0" ...



Only top voted, non community-wiki answers of a minimum length are eligible